Input validation error in libfm (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-8934
CWE-ID CWE-20
Exploitation vector Local
Public exploit N/A
Vulnerable software
 libfm (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Input validation error

EUVDB-ID: #VU33500

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-8934

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application unavailability).

Mitigation

Install update from vendor's website.

Vulnerable software versions

libfm (Alpine package): 1.2.5-r1

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=3b71bd4740135cb64c8af1a0abeb1dfbb7aaff7b
https://git.alpinelinux.org/aports/commit/?id=d276fa6d89a6d82dc00628912b59c814d1715cbc
https://git.alpinelinux.org/aports/commit/?id=c8d8c044fd84b87d72a5a89cc331d2d1d14c3442
https://git.alpinelinux.org/aports/commit/?id=f4d50b1370c7d70aa90eb645fe3dad9eb6a8c7dd
https://git.alpinelinux.org/aports/commit/?id=a28f3503a4b1c9910c9dd1a9984053ba50570029


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###